GHSA-p29c-jpgj-v57r

Froxlor arbitrary code execution via the database configuration options

Source: GitHub Advisory Database (reviewed) High CVE-2020-10235

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	froxlor/froxlor	< 0.10.14	0.10.14

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-10235 advisory
https://github.com/Froxlor/Froxlor/commit/62ce21c9ec393f9962515c88f0c489ace42bf656 web
https://github.com/Froxlor/Froxlor/commit/7e361274c5bf687b6a42dd1871f6d75506c5d207 web
https://bugzilla.suse.com/show_bug.cgi?id=1165721 web
https://github.com/Froxlor/Froxlor package
https://github.com/Froxlor/Froxlor/compare/0.10.13...0.10.14 web